Echo: Decompress permits unbounded gzip expansion in v4

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it, consuming excessive memory or CPU and allowing repeated or concurrent requests to cause denial of service. The middleware is not enabled by default, and limiting only the compressed request size does not bound the decoded size. This issue is fixed in 4.16.1.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…k/echo/security/advisories/GHSA-h7wr-284f-5qvc Diğer
• github.com/…ommit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f Diğer
• github.com/labstack/echo/releases/tag/v4.16.1 Diğer

Kayıt geçmişi

1. 28 Eki 2026 21:58Yayımlandı

İlgili açıklar

• 5,3 CVE-2026-118653Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration
• 6,1 CVE-2026-118652Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob
• 5,3 CVE-2026-118651Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default
• 7,5 CVE-2026-118650Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path
• 5,3 CVE-2026-118266Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method
• 5,3 CVE-2026-118265Echo: X-Real-IP extractor trusts the header value instead of the sending peer